@wtfalch/foundry 0.45.1 → 0.47.0

package/dist/plan/providers-readers.js

@@ -2,6 +2,7 @@ import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
 import { previewsOn } from './coolify-previews.js';
+import { APP_GONE_KIND, } from './live.js';
 import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
@@ -279,12 +280,23 @@ async function withBouleEnvConfig(client, resource, recorded, liveKeys) {
     // Boule must hold too. In memory only, compared by `planBoule` and never
     // written to a step, description or log.
     const orgId = recorded[resource.key]?.slice('boule:'.length);
-    const appUuid = Object.entries(recorded).find(([, value]) => value === `app:${orgId}:${APP_ENTRY_KEY}`)?.[0];
+    // The token sits on the org's main app, whatever its key; the reader does not know the
+    // declaration, so it tries the `app` entry first and then each other recorded app.
+    const appPrefix = `app:${orgId}:`;
+    const appUuids = Object.entries(recorded)
+        .filter(([, value]) => value.startsWith(appPrefix))
+        .sort(([, a], [, b]) => Number(b === `${appPrefix}${APP_ENTRY_KEY}`) - Number(a === `${appPrefix}${APP_ENTRY_KEY}`))
+        .map(([uuid]) => uuid);
     // A recorded app that is not in the live listing is gone: no app token, and
     // no read of its envs. A listed app whose read fails fails like any read.
-    const appToken = appUuid && liveKeys.has(appUuid)
-        ? (await client.listEnvs(appUuid)).find((e) => !e.is_preview && e.key === BOULE_MAIL_TOKEN_ENV)?.value
-        : undefined;
+    let appToken;
+    for (const appUuid of appUuids) {
+        if (!liveKeys.has(appUuid))
+            continue;
+        appToken = (await client.listEnvs(appUuid)).find((e) => !e.is_preview && e.key === BOULE_MAIL_TOKEN_ENV)?.value;
+        if (appToken)
+            break;
+    }
     return {
         ...resource,
         config: { ...resource.config, env, ...(appToken ? { appMailToken: appToken } : {}) },
@@ -416,7 +428,46 @@ export class ProvidersZitadelReader {
             this.liveIssuer(orgId, zitadelOrgId),
         ]);
         const mapped = applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
-        return issuer ? [...mapped, issuer] : mapped;
+        const gone = await this.goneApps(zitadelOrgId, resources, recorded);
+        return issuer ? [...mapped, ...gone, issuer] : [...mapped, ...gone];
+    }
+    /**
+     * #557: a recorded app the listing does not return, proven gone by a direct
+     * read by app id in every project the listing shows. One `app-gone`
+     * resource per proven app, keyed by the app's name: `diff.ts` offers the
+     * replacement only for it. Nothing is proven when the client has no
+     * `getApp` (providers before 0.12.0), when the read throws, or when it
+     * finds the app, so the plan blocks instead.
+     */
+    async goneApps(zitadelOrgId, listed, recorded) {
+        // A host may pass a client older than providers 0.12.0, which has no `getApp`.
+        const getApp = typeof this.client.getApp === 'function' ? this.client.getApp.bind(this.client) : undefined;
+        const listedIds = new Set(listed.filter((r) => r.kind === 'app').map((r) => r.key));
+        const projectIds = listed.filter((r) => r.kind === 'project').map((r) => r.key);
+        if (!getApp || projectIds.length === 0)
+            return [];
+        const gone = [];
+        for (const [appId, resourceKey] of Object.entries(recorded)) {
+            if (!resourceKey.startsWith('app:') || listedIds.has(appId))
+                continue;
+            try {
+                const found = await Promise.all(projectIds.map((projectId) => getApp(zitadelOrgId, projectId, appId)));
+                if (found.every((app) => app === null || app.state === 'APP_STATE_REMOVED')) {
+                    gone.push({
+                        system: 'zitadel',
+                        kind: APP_GONE_KIND,
+                        key: resourceKey.slice('app:'.length),
+                        config: {},
+                    });
+                }
+            }
+            catch (error) {
+                // Unproven, not gone: the plan blocks this app. Only the error's name is kept.
+                if (!(error instanceof ZitadelError))
+                    throw error;
+            }
+        }
+        return gone;
     }
     /**
      * #510: `client.listResources` reports only what is *inside* a ZITADEL org

package/dist/plan/sign-in-bindings.d.ts

@@ -13,4 +13,8 @@ export declare function editSignInBindings(coolify: Pick<CoolifyPort, 'listEnvs'
     instanceHost: string;
     upsert?: readonly LoginHostBinding[];
     remove?: readonly string[];
+    clientOrganizations?: {
+        upsert?: Readonly<Record<string, string>>;
+        remove?: readonly string[];
+    };
 }): Promise<void>;

package/dist/plan/sign-in-bindings.js

@@ -36,6 +36,16 @@ export async function editSignInBindings(coolify, input) {
         ...doc.bindings.filter((b) => !touched.has(b.host)),
         ...(input.upsert ?? []).map((b) => ({ ...b, clientIds: [...b.clientIds].sort() })),
     ].sort((a, b) => (a.host < b.host ? -1 : 1));
+    const orgs = input.clientOrganizations;
+    if (orgs && (Object.keys(orgs.upsert ?? {}).length > 0 || (orgs.remove ?? []).length > 0)) {
+        const merged = { ...doc.clientOrganizations, ...orgs.upsert };
+        const gone = new Set(orgs.remove ?? []);
+        const sorted = Object.fromEntries(Object.entries(merged)
+            .filter(([id]) => !gone.has(id))
+            .sort(([a], [b]) => (a < b ? -1 : 1)));
+        // An empty map is left out of the document, as it was before the first write.
+        doc.clientOrganizations = Object.keys(sorted).length > 0 ? sorted : undefined;
+    }
     const next = JSON.stringify(doc);
     if (live?.value === next)
         return;

package/dist/plan/sign-in-org.d.ts

@@ -7,6 +7,12 @@ export declare const ZITADEL_ORG_DOMAIN_SCOPE_KEY = "zitadel_org_domain";
  * names another org, the company plan holds the close step and no owner invite.
  */
 export declare const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_org_registration_closed";
+/**
+ * Scope id: the id of the customers org whose self-registration foundry
+ * closed, recorded only after `closeSelfRegistration` returned. Foundry closes
+ * once and never opens: a company that turns sign-up on keeps it on.
+ */
+export declare const ZITADEL_CUSTOMERS_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_customers_registration_closed";
 /** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
 export declare function closeSignInOrgRegistration(zitadel: Pick<ZitadelPort, 'closeSelfRegistration'>, orgId: string, recordScopeId: (key: string, id: string) => void, scopeKey?: string): Promise<void>;
 /** Scope id: the domain the sign-in server still refused to make primary after foundry set its domain policy and added the domain again. Set instead of failing; the planner reports it and plans the domain again. */
@@ -27,12 +33,17 @@ export declare function signInOrgDomain(org: {
     slug: string;
     domain: string | null;
 }): string;
+/** The fixed text for a domain the sign-in server already holds on another organisation. */
+export declare function signInDomainTakenText(domain: string): string;
 /**
- * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
- * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
- * A domain added while the policy still wanted proof stays unverified, so it
- * is removed and added again. A failure after the add leaves the domain on
- * the org but not primary, and nothing is recorded, so the next run repeats.
+ * Adds `domain` to the ZITADEL org, sets the server's domain policy
+ * ({@link SIGN_IN_DOMAIN_POLICY}) and makes the domain primary. Every call is
+ * idempotent. The add comes first, so foundry holds the domain before the
+ * policy stops asking for proof of ownership. A domain added while the policy
+ * still wanted proof stays unverified, so it is removed and added again (the
+ * remove-and-add gap: the domain is off the org for up to five seconds; known,
+ * left as is). A failure after the add leaves the domain on the org but not
+ * primary, and nothing is recorded, so the next run repeats.
  */
 export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
 /**
@@ -41,7 +52,7 @@ export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'ensureD
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */
-export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
+export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string, sleep?: (ms: number) => Promise<void>): Promise<boolean>;
 export interface EnsureSignInOrgOptions {
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
     /** Where the successful close is recorded (the org id). Absent: not recorded; the caller closes on every run. */
@@ -60,6 +71,8 @@ export interface EnsureSignInOrgOptions {
     orgScopeKey?: string;
     /** Defaults to {@link ZITADEL_ORG_DOMAIN_SCOPE_KEY}. */
     domainScopeKey?: string;
+    /** Waits between tries of the domain calls; a test passes a no-op. */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * Finds or creates the company's sign-in organisation by name, registers

package/dist/plan/sign-in-org.js

@@ -6,6 +6,12 @@ export const ZITADEL_ORG_DOMAIN_SCOPE_KEY = 'zitadel_org_domain';
  * names another org, the company plan holds the close step and no owner invite.
  */
 export const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_org_registration_closed';
+/**
+ * Scope id: the id of the customers org whose self-registration foundry
+ * closed, recorded only after `closeSelfRegistration` returned. Foundry closes
+ * once and never opens: a company that turns sign-up on keeps it on.
+ */
+export const ZITADEL_CUSTOMERS_REGISTRATION_CLOSED_SCOPE_KEY = 'zitadel_customers_registration_closed';
 /** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
 export async function closeSignInOrgRegistration(zitadel, orgId, recordScopeId, scopeKey = ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY) {
     await zitadel.closeSelfRegistration(orgId);
@@ -51,16 +57,35 @@ async function untilListed(work, retry, sleep) {
         }
     }
 }
+/** The fixed text for a domain the sign-in server already holds on another organisation. */
+export function signInDomainTakenText(domain) {
+    return `the sign-in domain ${domain} already exists on another organisation of the sign-in server, so foundry cannot add it; remove it there and apply again`;
+}
+/** Adds the domain; an "already exists" answer becomes {@link signInDomainTakenText}, which holds no cause. */
+async function addDomain(zitadel, orgId, domain) {
+    try {
+        await zitadel.addOrgDomain(orgId, domain);
+    }
+    catch (error) {
+        if (error instanceof Error && /already[ .]?exists/i.test(error.message)) {
+            throw new Error(signInDomainTakenText(domain));
+        }
+        throw error;
+    }
+}
 /**
- * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
- * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
- * A domain added while the policy still wanted proof stays unverified, so it
- * is removed and added again. A failure after the add leaves the domain on
- * the org but not primary, and nothing is recorded, so the next run repeats.
+ * Adds `domain` to the ZITADEL org, sets the server's domain policy
+ * ({@link SIGN_IN_DOMAIN_POLICY}) and makes the domain primary. Every call is
+ * idempotent. The add comes first, so foundry holds the domain before the
+ * policy stops asking for proof of ownership. A domain added while the policy
+ * still wanted proof stays unverified, so it is removed and added again (the
+ * remove-and-add gap: the domain is off the org for up to five seconds; known,
+ * left as is). A failure after the add leaves the domain on the org but not
+ * primary, and nothing is recorded, so the next run repeats.
  */
 export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    await addDomain(zitadel, orgId, domain);
     await zitadel.ensureDomainPolicy(SIGN_IN_DOMAIN_POLICY);
-    await zitadel.addOrgDomain(orgId, domain);
     // The sign-in server lists a domain a moment after it accepts the add, and
     // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
     try {
@@ -75,7 +100,7 @@ export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms)
     // Until the server lists the removal, the add sees the old unverified
     // domain and skips: both answers are a moment late, so ask again.
     await untilListed(async () => {
-        await zitadel.addOrgDomain(orgId, domain);
+        await addDomain(zitadel, orgId, domain);
         await zitadel.setPrimaryOrgDomain(orgId, domain);
     }, (error) => isDomainNotListed(error) || isPrimaryDomainRefused(error), sleep);
 }
@@ -85,9 +110,9 @@ export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms)
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */
-export async function registerSignInDomainOrBlock(zitadel, orgId, domain, recordScopeId, blockedScopeKey = ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY) {
+export async function registerSignInDomainOrBlock(zitadel, orgId, domain, recordScopeId, blockedScopeKey = ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, sleep) {
     try {
-        await registerSignInDomain(zitadel, orgId, domain);
+        await registerSignInDomain(zitadel, orgId, domain, sleep);
         return true;
     }
     catch (error) {
@@ -115,7 +140,7 @@ export async function ensureSignInOrg(options) {
     if (options.registrationClosedScopeKey) {
         recordScopeId(options.registrationClosedScopeKey, org.id);
     }
-    const registered = await registerSignInDomainOrBlock(zitadel, org.id, domain, recordScopeId, options.domainBlockedScopeKey);
+    const registered = await registerSignInDomainOrBlock(zitadel, org.id, domain, recordScopeId, options.domainBlockedScopeKey, options.sleep);
     if (!registered)
         return { orgId: org.id, created, domainBlocked: true };
     recordScopeId(options.domainScopeKey ?? ZITADEL_ORG_DOMAIN_SCOPE_KEY, domain);

package/dist/plan/sign-in.d.ts

@@ -31,10 +31,13 @@ export declare const SIGN_IN_LOGIN_APP_SCOPE_KEY = "coolify_platform_auth_login_
  * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
  * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
  * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
- *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
- *    the app's client id off the company's binding at the same write: that write and the base URI are the only
- *    moment the old path can fail, and they are the last two calls.
- * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). From auth 0.28.0 (one client may sit in two bindings of one company)
+ *    this is three writes: the app host's binding with the client id kept on the company's, the base URI, then
+ *    the company's binding without the id; sign-in works at every point. Before that release the login refuses
+ *    a client id held by two bindings, so one write moves the id off the company's binding: that write and the
+ *    base URI are the only moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host (0.28.0 and
+ * later: the company binding takes the id first and the app binding goes after the base URI); the app
  * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
  */
 /**
@@ -70,7 +73,11 @@ export declare const SIGN_IN_RATE_LIMIT_EXPRESSION = "(starts_with(http.request.
  * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
  */
 export declare function inAppSignIn(org: Pick<DeclaredOrg, 'signIn' | 'domain' | 'issuer' | 'services'>): boolean;
-/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+/**
+ * True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed.
+ * Accepted behaviour: a `SIGNIN_UPSTREAM` added by hand on Agora or Boule is drift like any other env foundry
+ * owns, so the next apply removes it. Foundry writes the value itself (`signInUpstream`) while the switch is on.
+ */
 export declare function staleSignInUpstream(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): boolean;
 /** The build argument (a build-time env in Coolify) that fixes the login's base path. */
 export declare const SIGN_IN_BUILD_ARG_ENV = "NEXT_PUBLIC_BASE_PATH";

package/dist/plan/sign-in.js

@@ -31,10 +31,13 @@ export const SIGN_IN_LOGIN_APP_SCOPE_KEY = 'coolify_platform_auth_login_sign_in_
  * 1. on: the login-host step trusts each app host ({@link SIGN_IN_TRUSTED_SCOPE_KEY}).
  * 2. on: the app step writes and deploys `SIGNIN_UPSTREAM` and records it live ({@link SIGN_IN_ENV_LIVE_SCOPE_PREFIX}).
  * 3. on: the login-host step binds each app host and points the base URI at `https://<app host>/sign-in/`
- *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). The login refuses a client id held by two bindings, so the bind moves
- *    the app's client id off the company's binding at the same write: that write and the base URI are the only
- *    moment the old path can fail, and they are the last two calls.
- * Off: the login-host step moves the client id back and points the base URI back at the login host; the app
+ *    ({@link SIGN_IN_IN_APP_SCOPE_KEY}). From auth 0.28.0 (one client may sit in two bindings of one company)
+ *    this is three writes: the app host's binding with the client id kept on the company's, the base URI, then
+ *    the company's binding without the id; sign-in works at every point. Before that release the login refuses
+ *    a client id held by two bindings, so one write moves the id off the company's binding: that write and the
+ *    base URI are the only moment the old path can fail, and they are the last two calls.
+ * Off: the login-host step moves the client id back and points the base URI back at the login host (0.28.0 and
+ * later: the company binding takes the id first and the app binding goes after the base URI); the app
  * step then drops `SIGNIN_UPSTREAM`; the login-host step then gives up the trusted domain.
  */
 /**
@@ -76,7 +79,11 @@ export const SIGN_IN_RATE_LIMIT_EXPRESSION = '(starts_with(http.request.uri.path
 export function inAppSignIn(org) {
     return org.signIn?.inApp === true && Boolean(org.domain) && org.issuer.usesDomain;
 }
-/** True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed. */
+/**
+ * True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed.
+ * Accepted behaviour: a `SIGNIN_UPSTREAM` added by hand on Agora or Boule is drift like any other env foundry
+ * owns, so the next apply removes it. Foundry writes the value itself (`signInUpstream`) while the switch is on.
+ */
 export function staleSignInUpstream(desired, live) {
     const held = live[SIGN_IN_UPSTREAM_ENV];
     return desired[SIGN_IN_UPSTREAM_ENV] === undefined && held !== undefined && held !== '';

package/dist/plan/signin-db-move.js

@@ -1,4 +1,5 @@
 import { pinnedRef } from '../bootstrap/versions.js';
+import { JobFailure, waitForJob as waitForJobApp } from './job-app.js';
 import { PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, findOrCreatePlatformApp, } from './platform-providers.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY, SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_NAME, SIGNIN_DB_PORT, SIGNIN_DB_USER, boundedCall, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
@@ -94,41 +95,16 @@ export function signinDbMoveNewUrl(host, password, database) {
 class MoveFailure extends Error {
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** Polls of an `exited` job with no `running` seen before it counts as a stop (an `exited` read can be the container before the deploy). */
-const JOB_EXITED_POLLS = 6;
-/**
- * Waits for the copy job to report healthy, which it does only after the counts match. The job never
- * exits on success, so any exit is final: `restarting` at once, `exited` once the job was seen running
- * or stayed exited for {@link JOB_EXITED_POLLS} polls. It has failed too at the deadline. A healthy
- * status read before any other could be the container before the stop, so it counts only after a
- * different status was seen.
- */
+/** Waits for the copy job to report healthy, which it does only after the counts match. */
 async function waitForJob(coolify, appId, runtime) {
-    const now = runtime.now ?? Date.now;
-    const sleep = runtime.sleep ?? defaultSleep;
-    const timeout = runtime.signinDbMoveTimeoutMs ?? 1_800_000;
-    const interval = runtime.signinDbMovePollMs ?? 10_000;
-    const deadline = now() + timeout;
-    let left = false;
-    let running = false;
-    let exitedPolls = 0;
-    for (;;) {
-        const { status } = await coolify.getApplication(appId);
-        if (status === 'running:healthy' && left)
-            return;
-        if (status !== 'running:healthy')
-            left = true;
-        if (status?.startsWith('running'))
-            running = true;
-        exitedPolls = status?.startsWith('exited') ? exitedPolls + 1 : 0;
-        if (status?.startsWith('restarting') ||
-            (status?.startsWith('exited') && (running || exitedPolls >= JOB_EXITED_POLLS))) {
-            throw new MoveFailure('the copy job stopped before the row counts matched');
-        }
-        if (now() >= deadline) {
-            throw new MoveFailure(`the copy job did not finish within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'})`);
-        }
-        await sleep(interval);
+    try {
+        await waitForJobApp(coolify, appId, runtime, {
+            job: 'the copy job',
+            stopped: 'the copy job stopped before the row counts matched',
+        });
+    }
+    catch (error) {
+        throw error instanceof JobFailure ? new MoveFailure(error.message) : error;
     }
 }
 /** Coolify queues a stop. Waits until it reports the app stopped; `pg_dump` must not run while ZITADEL can still write. */

package/dist/plan/worker-app.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { WORKER_APP_HYPERDRIVE_BINDING, WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHostId, } from '../worker-app-config.js';
+import { WORKER_APP_HYPERDRIVE_BINDING, WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
 import { entryAuthEnv } from './broker-entries.js';
 import { workerAppHostname } from './hostnames.js';
 import { appStepKey } from './platform-diff.js';
@@ -315,6 +315,8 @@ export function planWorkerApps(org, recordedIds, input) {
             description: `${at} is blocked, not planned: ${why}`,
             key,
         });
+        if (!workerAppHasBuild(app))
+            continue;
         if (!input.available) {
             block('the host supplies no WorkerAppPort');
             continue;

package/dist/refuse-org.d.ts

@@ -0,0 +1,7 @@
+import { type DeclaredOrg, type OrgRefusal } from './org.js';
+/**
+ * The first refusal of the whole-company validation a store write runs for
+ * hosting (every entry, its sign-in included) and customers, or `null`. Locked
+ * names are the org's own; the platform's service names are not known here.
+ */
+export declare function refuseOrg(org: DeclaredOrg): OrgRefusal | null;

package/dist/refuse-org.js

@@ -0,0 +1,10 @@
+import { refuseCustomers, refuseHosting } from './org.js';
+import { hostingNames } from './plan/locked-hostnames.js';
+/**
+ * The first refusal of the whole-company validation a store write runs for
+ * hosting (every entry, its sign-in included) and customers, or `null`. Locked
+ * names are the org's own; the platform's service names are not known here.
+ */
+export function refuseOrg(org) {
+    return refuseHosting(org.hosting, hostingNames(org, [])) ?? refuseCustomers(org);
+}

package/dist/requested-changes.d.ts

@@ -1,4 +1,5 @@
-import { type DeclaredOrg, type MailMode, type OrgId } from './org.js';
+import type { BuildJson } from './build-json.js';
+import { type CustomersConfig, type DeclaredOrg, type HostingEntry, type MailMode, type OrgId } from './org.js';
 import type { PlanDetail } from './plan/diff.js';
 /**
  * The whitelist of `DeclaredOrg` fields a company's own Boule can request a
@@ -15,7 +16,7 @@ import type { PlanDetail } from './plan/diff.js';
  * lowering or leaving a limit unchanged -- raising either one needs
  * approval too, until a billing field exists to say what the raise costs.
  */
-export type RequestableField = 'calls' | 'customers' | 'storageLimit' | 'aiLimit' | 'domain' | 'mailTier';
+export type RequestableField = 'calls' | 'customers' | 'storageLimit' | 'aiLimit' | 'domain' | 'mailTier' | 'app' | 'build';
 export declare const REQUESTABLE_FIELDS: readonly RequestableField[];
 /** Turn the org's own calls Matrix stack (`org.ts`'s `CallsConfig.enabled`) on or off. */
 export interface CallsChange {
@@ -52,12 +53,34 @@ export interface MailTierChange {
     field: 'mailTier';
     mode: MailMode;
 }
+/**
+ * Put or remove one hosting entry of the company's own app (`org.ts`'s `HostingEntry`).
+ * `before` and `after` are the entry as the requester saw it and as it should be (null when absent).
+ * `customers` is the switches after the change when the request changes them, else null.
+ * Archon validates the whole company; {@link classifyChange} does not look at the org for this kind.
+ */
+export interface AppChange {
+    field: 'app';
+    key: string;
+    op: 'put' | 'remove';
+    before: HostingEntry | null;
+    after: HostingEntry | null;
+    customers: CustomersConfig | null;
+}
+/** Deploy one release of the company's app from its `build.json` (`build-json.ts`). */
+export interface BuildChange {
+    field: 'build';
+    key: string;
+    repo: string;
+    release: string;
+    build: BuildJson;
+}
 /**
  * One company-requested change to its own declared org, keyed by
  * {@link RequestableField}. `classifyChange` and the store both switch on
  * `.field`.
  */
-export type RequestedChangeValue = CallsChange | CustomersChange | StorageLimitChange | AiLimitChange | DomainChange | MailTierChange;
+export type RequestedChangeValue = CallsChange | CustomersChange | StorageLimitChange | AiLimitChange | DomainChange | MailTierChange | AppChange | BuildChange;
 /**
  * `auto`: nothing further is required -- archon may carry the request
  * straight into a plan and apply it. `approval`: a human must approve the
@@ -72,7 +95,21 @@ export type ChangeClassification = 'auto' | 'approval';
  * onward. Foundry only stores and classifies (#178 "Why"); nothing in this
  * package transitions a state past its initial value.
  */
-export type RequestedChangeState = 'auto' | 'needs_approval' | 'approved' | 'rejected' | 'applied';
+export type RequestedChangeState = 'auto' | 'needs_approval' | 'approved' | 'rejected' | 'applied' | 'applying' | 'failed';
+/** Why an `app` or `build` request is `failed`. */
+export type FailureCode = 'replaced' | 'refused' | 'busy' | 'timed_out' | 'apply_error';
+/** Who asked: a person in Boule, or a release build. `requestedBy` keeps the raw principal id for audit. */
+export type RequestedBy = {
+    via: 'boule';
+    person: {
+        id: string;
+        name: string;
+    };
+} | {
+    via: 'build';
+    repo: string;
+    release: string;
+};
 /**
  * One company-requested change to its own declared org, as stored --
  * `migrations/0017_requested_changes.sql`'s `foundry_requested_changes`
@@ -85,6 +122,15 @@ export interface RequestedChange {
     requestedBy: string;
     createdAt: string;
     state: RequestedChangeState;
+    /** Null for rows made before `app` and `build` requests. */
+    requester: RequestedBy | null;
+    idempotencyKey: string | null;
+    reason: {
+        code: FailureCode;
+        message: string;
+        replacedBy?: number;
+    } | null;
+    updatedAt: string;
 }
 /**
  * Thrown by {@link classifyChange} (and by the requested-change store's

package/dist/requested-changes.js

@@ -1,4 +1,4 @@
-import { validateCustomers } from './org.js';
+import { validateCustomers, } from './org.js';
 export const REQUESTABLE_FIELDS = [
     'calls',
     'customers',
@@ -6,6 +6,8 @@ export const REQUESTABLE_FIELDS = [
     'aiLimit',
     'domain',
     'mailTier',
+    'app',
+    'build',
 ];
 /**
  * Thrown by {@link classifyChange} (and by the requested-change store's
@@ -42,6 +44,9 @@ function applyRequestedChange(org, change) {
             return { ...org, domain: change.domain };
         case 'mailTier':
             return { ...org, mail: { ...org.mail, mode: change.mode } };
+        case 'app':
+        case 'build':
+            return org;
     }
 }
 /**
@@ -115,6 +120,9 @@ export function classifyChange(org, change, plan) {
     if (!REQUESTABLE_FIELDS.includes(change.field)) {
         throw new RequestedChangeError(`'${change.field}' is not a requestable field`);
     }
+    // Archon validates the whole company for these; nothing waits for approval.
+    if (change.field === 'app' || change.field === 'build')
+        return 'auto';
     if (change.field === 'customers') {
         validateCustomersChange(change);
         // The org after the change must still pass the rule apply checks, for example open registration

package/dist/store/postgres.d.ts

@@ -1,4 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
+import type { OrgRefusal, OrgRefusalCode } from '../org.js';
 import { type ReleaseStore } from '../release/state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore, type RequestedChangeStore } from '../store.js';
 /**
@@ -38,7 +39,10 @@ export declare function uniqueViolationConstraint(error: unknown): string | unde
  * is that throw.
  */
 export declare class DeclaredOrgError extends Error {
-    constructor(message: string);
+    /** Set when a hosting or customers validator refused the write: which rule, and where in the org. */
+    readonly code?: OrgRefusalCode;
+    readonly path?: string;
+    constructor(message: string, refusal?: Pick<OrgRefusal, 'code' | 'path'>);
 }
 /**
  * `DeclaredOrgStore` (`../store.ts`) on Postgres, for #18: create, read and